Took me a while to figure this all out but got there in the end.
You need to do 3DS on the initial generation of the reference transaction ID, you pass along the data using the same variables EXCEPT with PayFlow you should not use "ECI3DS" and instead use "ECI" only.
You can then safely use the reference transaction ID for future transactions without requiring 3DS again (apparently!).
I think it's going to be a bit of time will tell, but for certain, you need to 3DS the first transaction/authorization.